Frameworks

Next.js integration

Use server routes for the OAuth transaction and callback.

Server-backed flow

Register an exact HTTPS callback. On the backend, generate a new random state and PKCE verifier, derive its S256 challenge, and store the transaction in a short-lived server session tied to the browser. Redirect to https://auth.bhauu.online/oauth/authorize with response_type=code and scope=profile email. At callback, validate state and exchange the code once. Include a server-held client secret only if this registered client uses one; the programming language alone does not make it confidential.

Start route

In a Next.js Route Handler, generate the verifier and state on the server. Store them in a short-lived protected server transaction keyed to the browser. Redirect only after the transaction is saved. Do not pass a client secret or verifier to a client component.

Next.js server building block

import { randomBytes, createHash } from 'node:crypto';
export async function GET() {
  const verifier = randomBytes(32).toString('base64url');
  const state = randomBytes(32).toString('base64url');
  const challenge = createHash('sha256').update(verifier, 'ascii').digest('base64url');
  const url = new URL('https://auth.bhauu.online/oauth/authorize');
  for (const [k, v] of Object.entries({ client_id: 'YOUR_CLIENT_ID', redirect_uri: 'https://example.com/auth/callback', response_type: 'code', scope: 'profile email', state, code_challenge: challenge, code_challenge_method: 'S256' })) url.searchParams.set(k, v);
  // Connect a protected server transaction store and save { state, verifier }.
  throw new Error('Server transaction store required before OAuth redirect');
}

Callback route

Retrieve and consume the saved transaction, compare state, then exchange the code server-side using the Node.js token request fields. Establish your own protected application session. The scaffold above intentionally fails until transaction persistence is connected.

Complete application sign-in

Use the returned access token with https://auth.bhauu.online/oauth/userinfo if scoped identity claims are needed. Establish an HttpOnly, Secure, SameSite application-session cookie where suitable, with CSRF protection. Clear the pending state and do not expose tokens to templates or logs. Handle local logout and Bhauu-side revocation separately.